From 830128cd952abe663a9d457160133433e75e79dc Mon Sep 17 00:00:00 2001
From: Benny Halevy <bhalevy@scylladb.com>
Date: Thu, 8 Apr 2021 20:30:48 +0300
Subject: [PATCH] streaming: stream_session: do not log err.c_str verbatim

It is dangerous to print a formatted string as is, like
sslog.warn(err.c_str()) since it might hold curly braces ('{}')
and those require respective runtime args.

Instead, it should be logged as e.g. sslog.warn("{}", err.c_str()).

This will prevent issues like #8436.

Refs #8436

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>
Message-Id: <20210408173048.124417-2-bhalevy@scylladb.com>
---
 streaming/stream_session.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/streaming/stream_session.cc b/streaming/stream_session.cc
index d229588437..e8e5254bc6 100644
--- a/streaming/stream_session.cc
+++ b/streaming/stream_session.cc
@@ -91,13 +91,13 @@ static auto get_session(utils::UUID plan_id, gms::inet_address from, const char*
     auto sr = get_stream_result_future(plan_id);
     if (!sr) {
         auto err = format("[Stream #{}] GOT {} from {}: Can not find stream_manager", plan_id, verb, from);
-        sslog.debug(err.c_str());
+        sslog.debug("{}", err.c_str());
         throw std::runtime_error(err);
     }
     auto coordinator = sr->get_coordinator();
     if (!coordinator) {
         auto err = format("[Stream #{}] GOT {} from {}: Can not find coordinator", plan_id, verb, from);
-        sslog.debug(err.c_str());
+        sslog.debug("{}", err.c_str());
         throw std::runtime_error(err);
     }
     return coordinator->get_or_create_session(from);
@@ -382,7 +382,7 @@ future<prepare_message> stream_session::prepare(std::vector<stream_request> requ
                 db.find_column_family(ks, cf);
             } catch (no_such_column_family&) {
                 auto err = format("[Stream #{}] prepare requested ks={} cf={} does not exist", plan_id, ks, cf);
-                sslog.warn(err.c_str());
+                sslog.warn("{}", err.c_str());
                 throw std::runtime_error(err);
             }
         }
@@ -396,7 +396,7 @@ future<prepare_message> stream_session::prepare(std::vector<stream_request> requ
             db.find_column_family(cf_id);
         } catch (no_such_column_family&) {
             auto err = format("[Stream #{}] prepare cf_id={} does not exist", plan_id, cf_id);
-            sslog.warn(err.c_str());
+            sslog.warn("{}", err.c_str());
             throw std::runtime_error(err);
         }
         prepare_receiving(summary);